SpringSecurity 1

 In POM.xml add dependency

<dependency>

<groupId>org.springframework.boot</groupId>

<artifactId>spring-boot-starter-security</artifactId>

</dependency>

then start your API , if you try to access a URL , you need to give

• username as "user"
• password seen in log "Using generated security password: b418f92c-xxx-xxx-xxx-xxx"

this can be overriden in "SecurityProperty.java"

https://docs.spring.io/spring-boot/appendix/application-properties/index.html

spring.security.user.password=pwd

spring.security.user.name=user

enter above in application.properties

Spring security keeps username and pwd in sesion , if you reload URL no issues

https://medium.com/@greekykhs/springsecurity-part-3-spring-security-flow-7da9cc3624ab

Servlets

Servlet container converts HTTP messages to ServletsRequests and hand over to servlet method as parameter

Servlet Filter

Used to intercept the request response and do some pre processing before business logic. Spring Security uses them.

there are 20 diff filters in spring sec

spring security is very serious about case sensitivity 

EazyBank App APIs

• some APIs like contact us should be outside security framework
• Pages
• Account Details
• Balance / Transaction History Details
• Loans 
• Cards 
• APIS : No Security
• contact us 
• notices
• APIs : With Security
• myAccount
• myBalane
• myLoans
• myCards